CVE-2022-1409

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.45% chance of exploitation in the next 30 days, 72th percentile

Published

2022-05-16

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1330f8f7-4a59-4e9d-acae-21656a4101fe

References

• CVE Record
• NVD entry

Related

• CVE-2022-1408
• CVE-2022-1411
• CVE-2022-1407
• CVE-2022-1412
• CVE-2022-1398
• CVE-2022-1416